Each laboratory that performs a test indicative of HIV or AIDS shall report to the county health department within 2 weeks.

To assure the confidentiality of the patient, reporting of HIV infection and AIDS must be conducted using a system developed by CDC or equivalent system. The CDC explains that "to safeguard the confidentiality and security of the data, CDC published guidelines in 2006 to ensure that data in the HIV surveillance system are held under the highest of security standards and with the most stringent protections. The guidelines were based on consultations with state HIV surveillance coordinators, CDC's Divisions of STD Prevention and TB Elimination, and security and computer staff in other CDC centers and offices and were reviewed by staff in the state and local surveillance programs."

These guidelines explain the mandatory confidentiality rules and protocols that each local, state, or government agency's reporting/surveillance system must have in place to ensure the utmost confidentiality of HIV/AIDS related data. These guidelines can be found in the "resources" page of this course. Those who violate any of the confidentiality rules listed in HIV/AIDS reporting/surveillance guidelines may be fined $500 per person, per offense.